# DF-5099 VERDICT

**Status: inconclusive (not runtime-exercisable on this guest) — defect
proven from source; Info hardening finding, PoC skipped per contract.**

## Reproduced?
No — and provably impossible on this guest. The joy(4) driver is
module-only (`/boot/kernel/joy.ko`); it attaches only to ISA/PnP gameport
hardware (`joy_probe`/`joy_attach`, `sys/dev/misc/joy/joy.c:103-135`).
The audit guest has no such hardware: `/dev/joy*` is absent, and even
after `kldload joy` no device node appears (see `run.log`, `env.txt`).
Both trigger binaries build cleanly on the guest (cc 8.3, `-Wall`, zero
diagnostics) and exit 2 at `open()` with ENOENT.

## Why the defect is real anyway (source proof)
* `joyopen()` — `joy.c:159-162`: `if (joy->timeout[i]) return EBUSY;`
  followed by `joy->timeout[i] = JOY_TIMEOUT;` — an unsynchronized
  check-then-set on shared state. No lock, token, or atomic anywhere in
  the file (includes at `joy.c:31-45`).
* `joyclose()` — `joy.c:173`: unconditional `joy->timeout[i] = 0;` —
  drops the exclusive claim while other holders may still have the
  device open (post-TOCTOU double-open, or dup'd fds closed out of
  order).
* Consequence: two racing `open()`s both succeed (EBUSY bypassed);
  exclusivity is advisory and racy. That is the entire impact — the
  raced fields are plain ints in a never-freed devclass softc (no detach
  method exists), so there is no memory-safety or lifetime consequence.

## Impact ceiling
Bounded by the device node's permissions: `make_dev(&joy_ops, unit, 0, 0,
0600, "joy%d", unit)` at `joy.c:133` creates the node root-only, so only
root reaches this code at all. Info severity is the correct ceiling.

## Why no fix validation
The fix (one-word atomic claim) is trivially correct by inspection but
cannot be behaviorally validated on a guest whose kernel never instantiates
the device. `fix.diff` is included untested-by-build; the guest was left
clean (`kldunload joy`, exit=0).

## Kernel references
- sys/dev/misc/joy/joy.c:159-162 (TOCTOU check-then-set in joyopen)
- sys/dev/misc/joy/joy.c:173 (joyclose clears claim unconditionally)
- sys/dev/misc/joy/joy.c:133 (root-only 0600 node — impact bound)
- sys/dev/misc/joy/joy.c:31-45 (no synchronization primitives included)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.